XML-RPC
XML-RPC is an old WordPress interface that lets outside software post to and manage your site, and it is one of the most commonly attacked doors on a WordPress install.
In plain English
It was built when people wrote posts in desktop apps and needed a way to send them to their blog. That job is now done by the REST API, which is safer and more capable.
The file is still there on most installs, at xmlrpc.php, and bots know it. It is a favourite for password guessing because it lets an attacker try many logins in a single request.
Why it matters
If nothing you use needs it, leaving it open is an unnecessary risk. Turning it off removes a whole family of attacks in one move.
It is also a quiet drain. A site under a steady XML-RPC probing attack spends real server resources answering bots.
How it works
-
A request arrives at xmlrpc.phpCarrying a command and a username and password.
-
WordPress runs the commandPublishing a post, fetching a list, editing content.
-
Many attempts fit in one requestWhich is exactly what makes it attractive for guessing passwords.
-
You disable itWith a security plugin, a filter in your functions file, or a rule at the server.
Check what still uses it first
The WordPress mobile app and a few older plugins and Jetpack features can rely on it. Turn it off, then use the site normally for a few days before you forget you did.